Describe the bug

When enabling encryption in a SAML provider, only certificates with a private key available are listed. According to the Authentik docs:

An encryption certificate is a public key certificate used by authentik to encrypt sensitive data in SAML assertions before sending them to an SP. This ensures that sensitive data within the assertion, such as user attributes and authentication details, remain confidential and can only be decrypted by the SP possessing the corresponding private key.

You should be able to select certificates defined without the private key specified. Only the SP needs to have the private key for decryption.

How to reproduce

Creates SAML provider and attempt to select an encryption certificate.

Expected behavior

Can select certificates without private keys associated.

Screenshots

No response

Additional context

No response

Deployment Method

Docker

Version

2025.10

Relevant log output